At the time I posted the message, it was leading on the majority of occasions to ftp://mail.rax.ru, and offering a file about 31Mb which appears to be clean, but now and again it was leading to http://95.211.26.32 which was offering a file named "K-Lite_Codec_Pack_1015_Mega.exe" which is about 41Mb big.